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Listing of Claims; 

1 . (Currently Amended) A method for detecting a spoofed network 
connection[[s]] comprising: 

receiving a connection from a client; 

delaying sending a greeting message for a delay period, the delay period being 
less than or equal to a maximum tolerable delay, the maximum tolerable delay being the longest 
delay that would be tolerated by a valid client; 

monitoring the connection during the delay period; and 
if a command is received from the client before the greeting is sent, then 
identifying the connection as the spoofed connection. 

2. (Original) The method of claim 1 further comprising: 
sending the greeting to the client upon completion of the delay period. 

3. (Currently Amended) The method of claim 1 further comprising: 
processing any electronic mail associated with [[a]] the spoofed connection. 

4. (Previously Presented) The method of claim 3 wherein a spoofed- 
connection electronic-mail message is processed using a process selected from the group 
consisting of: 

deleting the spoofed-connection electronic-mail message; 

marking the spoofed-connection electronic-mail message; and 

storing the spoofed-connection electronic-mail message in an electronic directory. 

5. (Original) The method of claim 1 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

6. (Original) The method of claim 1 wherein the client is a Mail Transfer 
Agent (MTA) or Mail User Agent (MUA). 
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7. (Original) The method of claim 1 wherein the received command is a 
Simple Mail Transfer Protocol (SMTP) command. 

8. (Currently Amended) A method for detecting a spoofed network 
■ connection[[s]] comprising: 

receiving a first command at a server from a client; 

delaying, for a delay period, a transmission of a reply associated with the first 
command, the delay period being less than or equal to a maximum tolerable delay, the maximum 
tolerable delay being the longest delay that would be tolerated by a valid client; 

monitoring a connection between the server and the client during the delay period; 

and 

if a second command is received at the server before the reply is transmitted, then 
identifying the connection as the spoofed connection. 

9. (Original) The method of claim 8 further comprising: 

sending a greeting to the client when the connection is established with the server. 

1 0. (Original) The method of claim 8 further comprising: 
transmitting the reply upon completion of the delay period. 

11. (Original) The method of claim 8 further comprising: 
processing any electronic mail associated with the spoofed connection. 

12. (Original) The method of claim 8 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

13. (Original) The method of claim 8 wherein the client is a Mail Transfer 
Agent (MTA) or Mail User Agent (MUA). 

14. (Original) The method of claim 8 wherein the received command is a 
Simple Mail Transfer Protocol (SMTP) command. 
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15. (Currently Amended) An apparatus for detecting a spoofed 
connection[[s]] comprising: 

means for detecting when a connection is established between the apparatus and a 

client device; 

means for transmitting a greeting message or a reply or both to the client device; 

means for delaying the transmitting means so that the greeting message or the 
reply or both are not transmitted during a delay period, the delay period being less than or equal 
to a maximum tolerable delay, the maximum tolerable delay being the longest delay that would 
be tolerated by a valid client; and 

means for monitoring the connection to detect commands that are sent by the 
client device at least during the delay period. 

1 6. (Original) The apparatus of claim 1 5 wherein the client device is a Mail 
Transfer Agent (MTA) or Mail User Agent (MUA). 

1 7. (Original) The apparatus of claim 1 5 wherein the detecting means, the 
transmitting means, the delaying means, and the monitoring means comprise one or more 
processor-based devices running software algorithms to provide the detecting, transmitting, 
delaying and monitoring functions. 

18. (Original) The apparatus of claim 1 5 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

19. (Original) The apparatus of claim 1 5 wherein the commands are Simple 
Mail Transfer Protocol (SMTP) commands. 
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